LikeBtn WordPress Plugin EUVD-2026-114216

Two concrete, stacked prerequisites limit this flaw. First, the administrator must have DISABLED the plugin's default 'Be GDPR compliant' option; while enabled (the default), it hashes stored IP values and neutralizes the injected payload, so default installations are not exploitable. Second, exploitation requires an action by an administrator - the attacker cannot trigger execution themselves; the stored payload only fires when an admin accesses the injected page (the plugin's votes view that renders the Client-IP value). The injection itself is remote and unauthenticated via the HTTP_CLIENT_IP (Client-IP) request header. Together these mean realistic risk is confined to sites that have opted out of GDPR IP-hashing AND whose administrators subsequently view the vote/IP data.

This is a genuinely lower-priority issue despite being a stored XSS, and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 4.7 (Medium), and the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N reflects why: although the injection point is network-reachable and unauthenticated (AV:N, PR:N), exploitation carries high attack complexity (AC:H) and requires user interaction (UI:R). The description explains both: the attack only works if the administrator has DISABLED the default 'Be GDPR compliant' option (which otherwise hashes stored IPs and neutralizes the payload), and the attacker cannot self-trigger - an administrator must view the injected page. The input provides no EPSS score, no CISA KEV listing, and no PoC/exploit reference, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month,' not 'act_now' or 'emergency,' which aligns with a Medium-severity, condition-dependent flaw. Net: this is a real but low-urgency bug gated behind a non-default configuration and a required admin action, not a high-CVSS-but-overstated issue - the CVSS already encodes the limiting factors honestly. Missing data: no EPSS and no KEV data were supplied, so widespread-exploitation probability cannot be quantified from the input.

An unauthenticated attacker sends an HTTP request to the target WordPress site with a crafted HTTP_CLIENT_IP (Client-IP) header containing a JavaScript payload, which the LikeBtn plugin stores alongside vote data without sanitization. The payload lies dormant until a site administrator opens the plugin's votes page in the dashboard, at which point the script executes in the administrator's authenticated browser session. No public exploit code is identified in the provided data; exploitation additionally depends on the non-default 'Be GDPR compliant' option being disabled.